You need to look into a technique called lag compensation to solve this. It’s standard in pretty much every FPS. If you google it, the top result should give you a pretty good idea of what you need to do. Basically the idea is that you need to rewind time on the server so that it sees the same things the client did when it took the shot. Then you can do an authoritative hit scan on the server without any risk of hackers spoofing positions.